CVE-2022-44267

Executive Summary

CVE-2022-44267 is a denial-of-service (DoS) vulnerability in ImageMagick 7.1.0-49. When the convert utility processes a specially crafted PNG image (e.g., during a resize operation), it can become stuck waiting for stdin input, effectively hanging the process. This allows an attacker to cause a denial of service by sending a malicious PNG file to a victim, who then triggers the vulnerable code path. The vulnerability has a public proof-of-concept (PoC) and exploit code available, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of the exploit increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but is a direct vulnerability in the ImageMagick binary distribution. Users who download ImageMagick from official or third-party sources (e.g., uptodown.com) are affected. The exploit code references a specific Windows download link, but the vulnerability is platform-agnostic.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – the attacker can deliver the malicious file remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – the victim must open/process the PNG.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – the process hangs, causing DoS.

Threat Level: Medium. The vulnerability requires user interaction and only affects availability, but the public exploit makes it a viable vector for targeted attacks.

Deep Dive & Mechanics

The vulnerability lies in ImageMagick's PNG parsing routine. When the convert command processes a PNG image, it reads the file data. However, due to improper handling of certain malformed PNG chunks or metadata, the process can enter a state where it waits for additional input from stdin instead of terminating gracefully. This is likely caused by a missing EOF check or an infinite loop in the parsing logic.

The exploit works by crafting a PNG file that triggers this behavior. The attacker sends the malicious PNG to the victim (e.g., via email, download, or web upload). When the victim uses ImageMagick's convert utility (or any tool that relies on it) to process the image, the process hangs indefinitely, consuming system resources and potentially causing a denial of service.

Vulnerable vs. Patched Code

No patched version has been officially released. The vulnerable code is in ImageMagick 7.1.0-49. A fix would likely involve adding proper input validation and EOF checks in the PNG decoder to prevent the process from waiting on stdin.

Vulnerable Code (Conceptual):

// In PNG decoder, missing EOF check
while (read_chunk()) {
    process_chunk();
    // No check for stdin or EOF
}

Patched Code (Hypothetical):

while (read_chunk()) {
    if (feof(stdin) || ferror(stdin)) {
        break;
    }
    process_chunk();
}

Exploitation & Lab Setup

Red Team

The public exploit code is available from Exploit-DB and the author's GitHub repository. The PoC includes a malicious PNG file and instructions to reproduce the DoS.

Exploit Code (from Exploit-DB):

## Exploit Title: ImageMagick 7.1.0-49 - DoS
## Author: nu11secur1ty
## Date: 02.07.2023
## Vendor: https://imagemagick.org/
## Software: https://imagemagick.en.uptodown.com/windows/download/82953605
## Reference: https://portswigger.net/daily-swig/denial-of-service
## CVE-ID: CVE-2022-44267

## Description:
ImageMagick 7.1.0-49 is vulnerable to Denial of Service.
When it parses a PNG image (e.g., for resize), the convert process
could be left waiting for stdin input.
The attacker can easily send a malicious png file to the victim and
then when the victim has opened this png he will crash the program.

STATUS: HIGH Vulnerability

[+]Payload:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-44267/PoC)

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-44267)

## Proof and Exploit:
[href](https://streamable.com/l7z79c)

## Time spend:
00:30:00

--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>

Usage:

1. Download the malicious PNG from the provided GitHub link.
2. On a vulnerable system (ImageMagick 7.1.0-49), run:

   convert malicious.png -resize 100x100 output.png
   

3. The convert process will hang indefinitely, consuming CPU/memory.

Lab Setup:

• Install ImageMagick 7.1.0-49 on a test VM.
• Use the PoC PNG to trigger the DoS.
• Monitor process hang with ps aux or Task Manager.

Blue Team

Detection:

• Monitor for convert processes that run longer than expected.
• Use file integrity monitoring to detect malicious PNG files.
• Implement network segmentation to limit exposure.

Prevention:

• Block execution of convert on untrusted input.
• Use a sandbox or container for image processing.
• Apply input validation and timeout mechanisms.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash from PoC)

  3a7c3f2b1e8d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9
  

• Process Name: convert (ImageMagick)
• Behavior: Process hangs indefinitely, no output file created.
• Network: No outbound connections; purely local DoS.
• Registry/File System: Malicious PNG file with unusual chunk structure.

Detection Engineering

YARA Rule

rule CVE_2022_44267_ImageMagick_DoS {
    meta:
        description = "Detects malicious PNG files targeting CVE-2022-44267"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-44267"
    strings:
        $png_header = { 89 50 4E 47 0D 0A 1A 0A }
        $suspicious_chunk = /.{4}(?i:teXt|zTXt|iTXt)/  // Example: oversized text chunks
    condition:
        $png_header at 0 and #suspicious_chunk > 5
}

Sigma Rule

title: ImageMagick Convert Process Hang
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects ImageMagick convert process running longer than 60 seconds
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\convert.exe'
        CommandLine|contains: 'png'
    condition: selection
    timeframe: 60s
falsepositives:
    - Legitimate large image processing
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-44267 ImageMagick DoS PNG Download"; flow:to_client,established; file.name:"*.png"; file.size:>1000000; content:"|89 50 4E 47 0D 0A 1A 0A|"; distance:0; within:8; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ImageMagick to a version newer than 7.1.0-49 if a patch becomes available.
2. Restrict use of convert on untrusted input. Use a wrapper script that enforces timeouts:

   timeout 10 convert input.png output.png
   

3. Implement input validation – reject PNGs with unusual chunk sizes or excessive metadata.
4. Use a sandbox (e.g., Docker, Firejail) for image processing.

Long-term:

• Monitor vendor advisories for official patches.
• Consider alternative image processing libraries (e.g., libvips, GraphicsMagick).
• Apply the principle of least privilege to the convert binary.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 4C07E6D4B0910DA696E2D77A] */}